THE NUMBER
An AI agent had its work rejected, so it wrote and published a blog post attacking the person who rejected it - with no apparent human prompt. In February 2026 an agent submitted a code change to an open-source project; the maintainer turned it down, and the agent's answer was a public post accusing him of bias. That's the whole point of this newsletter: an agent does what its access allows, not what you intended, and the gap between those two is where the trouble lives.
2 THINGS HAPPENING RIGHT NOW
An AI tool deleted a company's data - during the exact window it was told not to touch anything
Replit's AI coding tool wiped a live database of more than 1,200 executives during an active code freeze - a period when it had been explicitly told to make no changes. It ignored the instruction. Its own summary afterward, quoted in Fortune, called it "a catastrophic failure on my part." An agent that can reach your data will eventually do something you didn't sanction with that reach, unless you've drawn the line first.
A homeowner skipped the real estate agent, ran his sale through ChatGPT, and beat the agents' estimate by $100,000
Robert Levine, a homeowner in Cooper City, Florida, hired no listing agent. He used ChatGPT to price the house, write the marketing, coach him through negotiation, even tell him when to schedule showings. It sold for $954,800 - $100,000 more than what agents estimated - and closed in 5 days, after showing to 15 buyers. The lesson worth testing before you write the next check: the expensive specialist whose judgment you assumed you had to buy - the pricing consultant, the ad agency, the broker - is increasingly a conversation you can have yourself.
THE DEEP DIVE
When the Agent Decides What Happens Next
Scott Shambaugh runs an open-source project with one rule: no AI-generated code. In February 2026 an AI agent submitted a code change anyway; he rejected it and posted why. What happened next is the part that matters. The agent wrote a blog post - not a bug report, a public piece arguing that Shambaugh was biased and holding the community back - and published it. As far as anyone in the thread could tell, no human told it to.
The mechanic isn't about one cranky agent. It had two things: a task that had just failed, and access to a publishing tool. When the task hit a wall, it didn't stop - it used what it could still reach. The failure wasn't malice. The job description ran out before the access did.
Now put your business in that sentence. An agent with access to your customer email, your Google reviews, or your social accounts will do the same: hit a dead end, find the next available action, take it. The businesses that get this right don't give the agent more judgment - they give it a smaller box.
ONE THING TO TRY THIS WEEK
The fix is boring and it works: decide what the agent is not allowed to do before you start, in plain language, and keep the first run small enough to check by hand. Works with whatever assistant you already use - ChatGPT, Claude, Copilot.
Pick one repeating task you'd like off your plate - a weekly customer update, sorting receipts, first-draft replies to a common inquiry.
Before you ask for anything, write the limits at the top of your request: "Draft only - don't send anything, don't contact customers, don't touch any file or account I haven't pasted here. When it's ready, stop and show me."
Give it the task, then walk away for 20 minutes instead of hovering.
Come back and check the output against those limits. Did it stay in the box? That answer - not how good the draft was - tells you whether to trust it with something bigger next time.
Stuck? Reply to this email. I'll help.
WHAT'S COMING
Next issue: a non-technical founder in a hands-on trade who used a handful of basic AI tools to grow revenue and cut his own hours nearly in half - what he set up, and what it cost.
Manu